CVE-2022-31669

描述

Harbor fails to validate the user permissions when updating tag immutability policies.  By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects.

如何修補 CVE-2022-31669

要修補 CVE-2022-31669,請將受影響套件升級到下列已修補版本。

• —升級至 2.4.3 或更新版本
• —升級至 1.10.13 或更新版本

CVE-2022-31669 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 2.0.0, < 2.4.3, >= 2.5.0, < 2.5.2
• >= 1.0.0, < 1.10.13

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-31669
• PATCHgithub.com/goharbor/harbor
• WEBgithub.com/goharbor/harbor/security/advisories/GHSA-8c6p-v837-77f6